5076 matches found
python-jinja2: ReDoS vulnerability in the urlize filter
A flaw was found in python-jinja2. The ReDOS vulnerability of the regex is mainly due to the sub-pattern a-zA-Z0-9.-+.a-zA-Z0-9.-+. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory...
python-jinja2: ReDoS vulnerability in the urlize filter
A flaw was found in python-jinja2. The ReDOS vulnerability of the regex is mainly due to the sub-pattern a-zA-Z0-9.-+.a-zA-Z0-9.-+. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory...
CVE-2021-42057
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases...
CVE-2021-42057
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases...
Sql injection
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases...
CVE-2021-42057
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases...
obsidian-dataview 代码注入漏洞
obsidian-dataview is a software application. A complex query language implementation of the Obsidian note-taking tool. A security vulnerability exists in versions prior to Obsidian Dataview 0.4.12-hotfix1, which stems from the software's lack of effective restrictions and filters for eval...
Snudown Encryption Problem Vulnerability
Snudown is an open source package. It is a reddit-specific branch of the Sundown Markdown parser used by GitHub, with added Python integration. Snudown has a cryptographic problem vulnerability that can be exploited by attackers to conduct DoS attacks...
EulerOS 2.0 SP3 : python-jinja2 (EulerOS-SA-2021-2609)
According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator an...
CVE-2021-41168
Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vulnerable to denial of service attacks to its reference table implementation. References written in markdown referencename:...
CVE-2021-41168
Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vulnerable to denial of service attacks to its reference table implementation. References written in markdown referencename:...
CVE-2021-41168
Summary. Snudown (reddit‑specific fork of Sundown) contains a vulnerability in the reference table hash implementation. The reference hashes use a weak hash function, enabling an attacker to generate many hash collisions, leading to a hash‑collision DoS attack and long retrieval times due to dupl...
PT-2021-23142 · Snudown · Snudown
Name of the Vulnerable Software and Affected Versions: Snudown versions prior to 1.7.0 Description: Snudown, a reddit-specific fork of the Sundown Markdown parser, is vulnerable to denial of service attacks due to its reference table implementation. The hash table used for references written in...
CVE-2021-39887
A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf...
CVE-2021-39887
A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf...
UBUNTU-CVE-2021-39887
A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf...
PT-2021-22733 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.4 and above Description: A stored Cross-Site Scripting issue in the GitLab Flavored Markdown allows an attacker to execute arbitrary JavaScript code on the victim's behalf. Recommendations: For GitLab CE/EE versions 8....
GitLab 跨站脚本漏洞
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to view a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab, whic...
PortlandLabs Concrete CMS Cross-Site Scripting Vulnerability (CNVD-2021-76090)
PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. PortlandLabs Concrete CMS 8.5.5 and earlier has a cross-site scripting vulnerability that could be attacked by an attacker via the "Markdown Comments" field...